Electrum Fixes Bitcoin (BTC) Wallet Flaw Exploited by Malicious Servers

Electrum's Bitcoin (BTC) wallet flaw let malicious servers replace a transaction's wallet-history entry after its broadcast, and developers said two users reported attacks, with one reporting a loss.

A user first broadcast a legitimate transaction. A malicious server could suppress it and replace its history entry with a conflicting, invalid transaction directed to the attacker. The fake transaction carried a zero fee. A user manually raised the fee and signed it, causing the payment to go to the attacker.

Electrum's developers said malicious servers had exploited the flaw in the wild. Version 4.8.3 is listed as patched. The technical disclosure adds details to Electrum's earlier release announcement, which urged users to install the update.